Kibana MCP Server

@ggilligan12

About Kibana MCP Server

MCP Server for Kibana SecOps

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": [
        "build",
        "-t",
        "kibana-mcp",
        "."
      ]
    }
  }
}

Tools

Fetch security alerts

Add tags to alerts

Change alert status (open/acknowledged/closed)

Search detection rules

Get rule exception items

Add exceptions to rules

Create new exception lists

Link exception lists to rules

Overview

What is Kibana MCP Server?

A Model Context Protocol (MCP) server that integrates with Kibana Security, enabling AI assistants to manage security alerts, detection rules, and exception lists programmatically.

How to use Kibana MCP Server?

Clone the repository, build the Docker image, set environment variables (KIBANA_URL plus either KIBANA_API_KEY or KIBANA_USERNAME/KIBANA_PASSWORD), then configure your MCP client (e.g., Claude Desktop) to run the container. Alternatively, run locally with uv sync and uv run kibana-mcp.

Key features of Kibana MCP Server

Fetch security alerts via get_alerts
Tag alerts with tag_alert
Change alert status (open/acknowledged/closed)
Search detection rules with find_rules
Retrieve and add rule exception items
Create and associate shared exception lists

Use cases of Kibana MCP Server

Automating alert triage from an AI chat interface
Bulk updating alert statuses during incident response
Adding exception rules to suppress known false positives
Orchestrating rule management across multiple Kibana instances

FAQ from Kibana MCP Server

What authentication methods are supported?

You can authenticate using either a Kibana API key (recommended) or a username/password combination.

How do I configure the server for my MCP client?

Set KIBANA_URL and your credentials as environment variables, then add a Docker-based MCP server entry in your client configuration (e.g., Claude Desktop or Cursor). Direct credentials in the args are also supported.

Can I run the server locally without Docker?

Yes. Install dependencies with uv sync, set the required environment variables, and start the server with uv run kibana-mcp.

Is there a test environment provided?

Yes. The repository includes a testing/quickstart-test-env.sh script that starts a local Kibana/Elasticsearch instance preloaded with test data.

What tools does the server expose?

Eight tools: get_alerts, tag_alert, adjust_alert_status, find_rules, get_rule_exceptions, add_rule_exception_items, create_exception_list, and associate_shared_exception_list.

Frequently asked questions

What authentication methods are supported?

You can authenticate using either a Kibana API key (recommended) or a username/password combination.

How do I configure the server for my MCP client?

Set `KIBANA_URL` and your credentials as environment variables, then add a Docker-based MCP server entry in your client configuration (e.g., Claude Desktop or Cursor). Direct credentials in the args are also supported.

Can I run the server locally without Docker?

Yes. Install dependencies with `uv sync`, set the required environment variables, and start the server with `uv run kibana-mcp`.

Is there a test environment provided?

Yes. The repository includes a `testing/quickstart-test-env.sh` script that starts a local Kibana/Elasticsearch instance preloaded with test data.

What tools does the server expose?

Eight tools: `get_alerts`, `tag_alert`, `adjust_alert_status`, `find_rules`, `get_rule_exceptions`, `add_rule_exception_items`, `create_exception_list`, and `associate_shared_exception_list`.

Comments

Basic information

More Other MCP servers

Sequential Thinking

modelcontextprotocol

Model Context Protocol Servers

88.2K

Lemon.io

lemon-io

Request dedicated senior developers to work on your project, write job descriptions, and prep technical interviews — all without leaving your Claude chat. Just describe what you need, and Lemon.io MCP does the rest. 1–3